Dashboard / CVE-2026-123092

CVE-2026-123092

HIGH
MEDIUM Priority: 0.01 BB Relevance: 55/100
Published: 2026-11-12 Modified: 2026-11-12 First seen: 2026-11-12 Status: active

Attack Surface

Network No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: High

Description

The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown WP Remote Users Sync 0 < 2.3.0
Unknown WP Remote Users Sync 0 < 2.3.0

References & Advisories (1)

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.17%
Raw Score 0.001690
Percentile 6.4%
Date 2026-11-12

Intelligence Sources

mitre ref →
nvd ref →

External Links